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DETAILED ACTION 
Response to Amendment 

This Office action has been issued in response to amendment filed 21 May 2007. Claims 
1-33 are pending. Applicant's arguments have been carefully and respectfully considered, and 
some are persuasive, while others are not. Accordingly, objections and rejections have been 
removed where arguments were persuasive, but rejections have been maintained where 
arguments were not persuasive. Accordingly, claims 1-33 are rejected, and this action has been 
made FINAL, as necessitated by amendment. 

Specification 

The title of the invention is not descriptive. A new title is required that is clearly 
indicative of the invention to which the claims are directed. The following title is suggested: 
Setting a Participant's Authorization Level Using Object Class Definition Tailoring. 

Claim Objections 

As per claims 1-13, 15, and 16, the phrase "one or more data processing apparatus" is 
incorrect. "Apparatus" should be plural. 

As per claim 7, the phrase "data processing apparatus receive user input" is incorrect. It 
should be "data processing apparatus to receive user input". 



Claim Rejections - 35 USC § 112 Second Paragraph 

The following is a quotation of the second paragraph of 35 U.S.C. 112: 
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The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the 
subject matter which the applicant regards as his invention. 

As per claim 17, the limitation "changing a status" is incomprehensible as written. For 
example, the phrase "a participant who is excluded from involving the field in the activity" is 
particularly unclear. The specification mentions excluding a user from performing a data 
processing activity that involves the respective fields, see the paragraph beginning on page 1 1 , 
line 22, but not a user who is excluded from involving a field in an activity. 



Claim Rejections - 35 USC § 101 

35 U.S.C. 101 reads as follows: 

Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or 
any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and 
requirements of this title. 

Claims 1-14 and 17-33 are rejected under 35 U.S.C. 101 because the claimed invention is 
directed to non-statutory subject matter. 

As per claims 1-14, according to the instant specification (see the paragraph beginning on 
page 17, line 27), the computer program product includes carrier waves. As such, the instant 
claims are non-statutory. 

As per claims 25-33, it appears that Applicant is trying to claim a data structure. 
However, the disclosed data structure is not "a physical or logical relationship among data 
elements, designed to support specific data manipulation functions" {The Authoritative 
Dictionary of IEEE Standards Terms, Seventh Edition, IEEE Press, 2000). As such, the instant 
claims are non-statutory. 
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Claim Rejections - 35 USC § 102 
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the 
basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(e) the invention was described in (1) an application for patent, published under section 122(b), by another filed 
in the United States before the invention by the applicant for patent or (2) a patent granted on an application for 
patent by another filed in the United States before the invention by the applicant for patent, except that an 
international application filed under the treaty defined in section 351(a) shall have the effects for purposes of this 
subsection of an application filed in the United States only if the international application designated the United 
States and was published under Article 21(2) of such treaty in the English language. 

Claims 1-33 are rejected under 35 U.S.C. 102(e) as being anticipated by Keinsley et al., 

U.S.P.G. Pub. 2003/0154403. 

As per claims 1-33, Keinsley et al. teach: 

1 . A computer program product, tangibly embodied in one ore more information carriers, 
for tailoring the storage of information, the computer program product comprising instructions 
operable to cause one or more data processing apparatus to: 

present a user with options for tailoring an object class definition (See e.g. Fig. 15B 
which is an administrative screen for tailoring an object, see [0570], "An access administrator for 
an entity or the IT security personnel of the sponsor organization can temporarily suspend a user 
for the entity... This is accomplished by defining a Suspense Period", and Fig. 15A which shows 
the tailored object, i.e. the list of users, see [0701], "A VB6 COM DLL exposes a single class 
(b_SystemApplication) containing methods to allow business functions to access data associated 
with the sponsor organization's secured logon application. Data stored and exposed includes 
Entity and User security information, as well as the function sets that are defined within the 
secured logon application data store"); 
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receive user input for tailoring the object class definition in response to the presentation 
of options, the user input identifying 

a first field to be included in the tailored object class definition (See e.g. Fig. 15B, 

the "Status" field under "Activity History" for user "Jones, Smith"), 

a second field to be included in the tailored object class definition (See e.g. Fig. 

15B, the "Status" field under "Activity History" but for a different user, e.g. "Jones, 

Don" from Fig. 15 A), 

a first user or group of users (See e.g. Fig. 15 A, user "Jones, Smith"), and 
a second participant (See e.g. Fig. 15A, user "Jones, Don"); 

redefine the tailored object class definition to include the first field and the second field 
(See e.g. Fig. 15 A, table column "Current Status" which shows the status defined in Fig. 15B 
where, see [0570], "An access administrator for an entity or the IT security personnel of the 
sponsor organization can temporarily suspend a user for the entity... This is accomplished by 
defining a Suspense Period"); 

associate a first identifier with the first field (See e.g. Fig. 15 A, table columns "AKA 
Name" and "Current Status" for user "Jones, Smith") to identify that the first user or group of 
users is to be excluded from a first activity that involves the first field (See e.g. Fig. 15B where, 
when the "Status" is "Inactive", the user is temporarily suspended, see e.g. [0570], "An access 
administrator for an entity or the IT security personnel of the sponsor organization can 
temporarily suspend a user for the entity"); and 

associate a second identifier with the second field (See e.g. Fig. 15 A, table columns 
"AKA Name" and "Current Status" for user "Jones, Don") to identify that the second user or 
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group of users is to be excluded from a second activity that involves the second field (See e.g. 
Fig. 15B where, when the "Status" is "Inactive", the user is temporarily suspended, see e.g. 
[0570], "An access administrator for an entity or the IT security personnel of the sponsor 
organization can temporarily suspend a user for the entity"); and 

make the association of the first identifier with the first field and the association of the 
second identifier with the second field available for data processing activities. 

2. The computer program product of claim 1, wherein the instructions also cause the one 
or more data processing apparatus to exclude the first user or group of users from the first 
activity (See e.g. [0570], "An access administrator for an entity or the IT security personnel of 
the sponsor organization can temporarily suspend a user for the entity"). 

3. The computer program product of claim 1, wherein the instructions cause the one or 
more data processing apparatus to receive user input identifying a role that the first user or group 
of users plays in an operation (See e.g. Fig. 15B where "Active" and "Inactive" are roles). 

4. The computer program product of claim 3, wherein the instructions cause the one or 
more data processing apparatus to associate an identifier of the role with the first field (See e.g. 
Fig. 15B where the column heading "Status" identifies the roles "Active" and "Inactive"). 

5. The computer program product of claim 1, wherein the instructions cause the one or 
more data processing apparatus to receive user input identifying a fieldgroup that includes the 
first field (See e.g. Fig. 15B where the column heading "Status" is the "fieldgroup" for the fields 
"Active" and "Inactive"). 

6. The computer program product of claim 1, wherein the instructions cause the one or 
more data processing apparatus to: 
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receive first user input identifying the first field and the second field from a first 
individual (See e.g. "[0570] An access administrator for an entity or the IT security personnel of 
the sponsor organization can temporarily suspend a user for the entity" where the "access 
administrator" can change a user's access level); and 

receive second user input identifying the first user or group of users and the second user 
or group of users from a second individual (See e.g. "[0570] An access administrator for an 
entity or the IT security personnel of the sponsor organization can temporarily suspend a user for 
the entity. Only the IT security personnel can temporarily suspend an entity or a user" where 
only the "IT security personnel" can change the user). 

7. The computer program product of claim 1 , wherein the instructions also cause the one 
or more data processing apparatus receive user input identifying the first activity from which the 
first user or group of users is excluded (See e.g. [0570], "An access administrator for an entity or 
the IT security personnel of the sponsor organization can temporarily suspend a user for the 
entity"). 

8. The computer program product of claim 7, wherein the instructions cause the one or 
more data processing apparatus to receive user input identifying an authorization level 
identifying the first activity (See e.g. [0570], "An access administrator for an entity or the IT 
security personnel of the sponsor organization can temporarily suspend a user for the entity" and 
Fig. 15B where, if the "Status" is "Inactive" the user has no authorization to access the system, 
see e.g. [0546], "1. If the processing status for the real entity-user corresponding to the virtual 
entity-user is Inactive, then the processing status for the virtual entity-user is Inactive. Essentially 



Application/Control Number: 10/674,327 Page 8 

Art Unit: 2168 

this means that if the company that employs this user has suspended or revoked the user, then 
any delegated access is also Inactive"). 

9. The computer program product of claim 8, wherein the instructions cause the one or 
more data processing apparatus to receive user input selecting the authorization level from a 
group of at least four authorization levels (See e.g. [0542], "3. The Entity User Selection Status 
for the Access Administrator (' AA') will be Active as long the user has not been suspended or 
revoked, and the entity is still active. From a status perspective, the user shows up on the current 
selection lists for an entity when the Entity User Display Status is 'Registered 5 , 'Active', or 
'Temporarily Inactive'. The user shows up on the Revoked selection list when the Entity User 
Display Status is 'Revoked'"). 

10. The computer program product of claim 1, wherein the instructions also cause the one 
or more data processing apparatus to: 

identify a trigger (See e.g. Fig. 15B, where the drop down menu "Reason" acts as a 
"trigger"); and 

based upon the identification of the trigger, end the association of the first identifier with 
the first field to indicate that the first user or group of users is no longer excluded from the first 
activity (See e.g. [0561], "Reinstate a User is equivalent to Register a User, where an existing 
user account is being used, where the user has been previously registered with the entity, and the 
status is Revoked. This results in reregistered and active status records being set up for the 
entity-user"). 

1 1 . The computer program product of claim 1 , wherein the instructions also cause the one 
or more data processing apparatus to: 
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receive user input identifying an operation performed with the tailored object (See e.g. 
[0004], "Sponsor organizations, such as healthcare companies, have clients that access their data 
and other resources over a distributed information retrieval system such as the World Wide Web. 
Such sponsor organizations have need of a stand-alone security system controlling access to 
secured information and self-service functionality for the sponsor organization"); and 

associate an operation identifier, the first identifier, and the first field to indicate that the 
first user or group of users is to be excluded from the first activity that involves the first field in 
the operation (See e.g. Fig. 15A and [0009], "5. Different users need to play different roles 
within the entities for which they work. This requirements means that there needs to be a way to 
assign roles to users"). 

12. The computer program product of claim 1 1, wherein the instructions cause the one or 
more data processing apparatus to receive user input identifying a collaboration of at least two 
parties (See e.g. Fig. 15A and [0007], "3. In order to use the system, each user needs to have the 
context in which he uses the system be defined. In general, the context is the organization for 
which he or she works. Typically these organizations are different from the sponsor organization. 
Having the context will drive what kinds of business functions and data are available to the 
user"). 

13. The computer program product of claim 1, wherein the instructions also cause the one 
or more data processing apparatus to instantiate the tailored object class definition (See e.g. Fig. 
15A and [0049], "Registration Process~The process whereby data about an entity, the Primary 
Controlling Authority, and the Primary Access Administrator are captured via an online process 
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and approved. The approval can be by the IT security personnel or it can be an automated 
approval process"). 

14. The computer program product of claim 1, wherein: 

the first activity comprises display of contents of the first field (See e.g. Fig. 15A where 
the "Current Status" of "Jones, Smith" is displayed as "Active"); and 

the second activity comprises display of contents of the second field (See e.g. Fig. 15A 
where the "Current Status" of "Jones, Don" is displayed as "Active"). 

15. The computer program product of claim 1, wherein the instructions cause the one or 
more data processing apparatus to create a graphical user interface to lead a user through the 
tailoring (See e.g. Figs. 15A-B). 

16. The computer program product of claim 15, wherein the instructions cause the one or 
more data processing apparatus to create the graphical user interface on a web browser (See e.g. 
Figs. 15A-B). 

17. A system comprising: 

a data storage device including tailored data object class definitions, the tailored data 
class definitions having user-defined data fields (See e.g. Fig. 15A which shows the "tailored 
data objects" defined by an administrator in Fig. 15B); and 

a data processing device in data communication with the data storage device, the data 
processing device being configured to perform data processing activities in accordance with a set 
of machine-readable instructions (See e.g. [0004], "Sponsor organizations, such as healthcare 
companies, have clients that access their data and other resources over a distributed information 
retrieval system such as the World Wide Web"), the activities including 
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identifying a trigger (See e.g. Fig. 15B, where the drop down menu "Reason" acts 
as a "trigger"); and 

changing a status of a field in a first instance of a tailored object based on 
identification of the trigger, wherein the status of the field is associated with an activity 
that involves the field and with a participant who is excluded from involving the field in 
the activity (See e.g. Fig. 15B where, when the "Status" is "Inactive", the user is 
temporarily suspended, see e.g. [0570], "An access administrator for an entity or the IT 
security personnel of the sponsor organization can temporarily suspend a user for the 
entity" and [0701], "A VB6 COM DLL exposes a single class (b_SystemApplication) 
containing methods to allow business functions to access data associated with the sponsor 
organization's secured logon application. Data stored and exposed includes Entity and 
User security information, as well as the function sets that are defined within the secured 
logon application data store"). 

18. The system of claim 17, wherein changing the status of the field includes ending an 
exclusion of the identified participant from involving the field in the activity (See e.g. [0561], 
"Reinstate a User is equivalent to Register a User, where an existing user account is being used, 
where the user has been previously registered with the entity, and the status is Revoked. This 
results in reregistered and active status records being set up for the entity-user"). 

19. The system of claim 18, wherein changing the status of the field includes releasing a 
field for display to all participants (See e.g. Fig. 15A where the "Current Status" of all users, i.e. 
"participants" is displayed). 
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20. The system of claim 17, further comprising operational instructions for the creation of 
a product (See e.g. [0036], "Dynamic Menus--the list of functions a user can perform based on 
the rights granted to him or her within the secured logon application. If a user does not have 
access to a particular function that function will not be presented as a menu item to the user"). 

21. The system of claim 17, wherein the tailored data object class definitions comprise: 
standard elements hardcoded into the tailored data object class definitions and hence not 

definable by a user (See e.g. Figs. 15A-B and [0570], "The result of any changes to the dates 
associated with a Suspense Period is that records are made of the new dates and an audit trail is 
created of the changes to the old dates"); and 

tailored elements including the user-defined data fields (See e.g. Fig. 15 A, column 
heading "Current Status"). 

22. The system of claim 21, wherein the standard elements comprise elements found in 
every member of a group of data object class definitions (See e.g. Figs. 15A-B). 

23. The system of claim 17, wherein the data processing device activities further include: 
receiving user input identifying an operation that involves the tailored object class 

definition, the operation including the activity that involves the field (See e.g. [0004], "Sponsor 
organizations, such as healthcare companies, have clients that access their data and other 
resources over a distributed information retrieval system such as the World Wide Web. Such 
sponsor organizations have need of a stand-alone security system controlling access to secured 
information and self-service functionality for the sponsor organization"); and 

associating an identifier of the operation with the status to indicate that the status is 
relevant to the operation (See e.g. Fig. 15A and [0009], "5. Different users need to play different 



Application/Control Number: 10/674,327 Page 13 

Art Unit: 2168 

roles within the entities for which they work. This requirements means that there needs to be a 
way to assign roles to users"). 

24. The system of claim 23, wherein the data processing device activity of receiving user 
input identifying the operation includes receiving user input identifying a collaboration of at least 
two parties (See e.g. Fig. 15A and [0007], "3. In order to use the system, each user needs to have 
the context in which he uses the system be defined. In general, the context is the organization for 
which he or she works. Typically these organizations are different from the sponsor organization. 
Having the context will drive what kinds of business functions and data are available to the 
user"). 

25. Memory for storing data for access during performance of a set of machine-readable 
instructions for performing operations on a data processing system, comprising: 

a data structure definition stored in the memory, the data structure definition including: 
a data structure definition identifier (See e.g. Fig. 15A which shows a data 

structure, i.e. the list of users, and is identified as "User Selection"); 

a collection of one or more hardcoded elements hardcoded into the data structure 

definition (See e.g. Fig. 15A where the table columns are "hardcoded" and the individual 

table cells are not); and 

a collection of one or more tailored elements to fit a specific data processing 

activity of a user (See e.g. Fig. 15B where, when the "Status" is "Inactive", the user is 

temporarily suspended, see e.g. [0570], "An access administrator for an entity or the IT 

security personnel of the sponsor organization can temporarily suspend a user for the 

entity"). 
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26. The memory of claim 25, wherein the data structure definition further comprises: 
a user identification field for identifying a user (See e.g. Fig. 15 A, "Jones, Don"); and 
an activity identification field for identifying an activity from which the user is excluded 

(See e.g. [0570], "An access administrator for an entity or the IT security personnel of the 
sponsor organization can temporarily suspend a user for the entity"). 

27. The memory of claim 26, wherein: 

the collection of one or more tailored elements comprises a field tailored to the specific 
data processing activity (See e.g. Fig. 15A where the "Current Status" contains a "field to fit the 
specific data processing activity"). 

28. The memory of claim 26, wherein the user identification field comprises an 
authorization level field (See e.g. [0546], "1. If the processing status for the real entity-user 
corresponding to the virtual entity-user is Inactive, then the processing status for the virtual 
entity-user is Inactive. Essentially this means that if the company that employs this user has 
suspended or revoked the user, then any delegated access is also Inactive"). 

29. The memory of claim 28, wherein the user identification comprises a field for 
receiving identification of one of four or more authorization levels (See e.g. [0542], "3. The 
Entity User Selection Status for the Access Administrator (' AA') will be Active as long the user 
has not been suspended or revoked, and the entity is still active. From a status perspective, the 
user shows up on the current selection lists for an entity when the Entity User Display Status is 
'Registered', 'Active', or 'Temporarily Inactive'. The user shows up on the Revoked selection 
list when the Entity User Display Status is 'Revoked'"). 
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30. The memory of claim 25, further comprising an association field for identifying that 
the data structure definition is associated with a particular operation (See e.g. Fig. 15A and 
[0009], "5. Different users need to play different roles within the entities for which they work. 
This requirements means that there needs to be a way to assign roles to users"). 

31. The memory of claim 25, wherein the data structure definition comprises an XML file 
(See e.g. Fig. 7 and [0727], "In certain instances it may be necessary or desirable for a system 
application or process to update the data in the secured logon application. In order to 
accommodate this functionality, the secured logon application includes a generic XML 
transaction processor"). 

32. The memory of claim 25, further comprising a communications application for 
exchange of the data structure definition with a remote system (See e.g. [0004], "Sponsor 
organizations, such as healthcare companies, have clients that access their data and other 
resources over a distributed information retrieval system such as the World Wide Web"). 

33. The memory of claim 32, wherein the communications application comprises a web 
service (See e.g. [0003], "The present invention relates to web-based security applications that 
provide controlled access to a sponsor organization's data and other resources"). 

Response to Arguments 
As per Applicant's argument that Keinsley et al. do not teach presenting a user with 
options for tailoring an object class definition in claim 1, the Examiner respectfully disagrees. 
The Examiner cited Fig. 15, which shows an interface to temporarily suspend a user. This 
interface allows an administrator to tailor an underlying object class definition, i.e. a user's 
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access rights. This is defined in [0701], "A VB6 COM DLL exposes a single class 
(b_SystemApplication) containing methods to allow business functions to access data associated 
with the sponsor organization's secured logon application. Data stored and exposed includes 
Entity and User security information, as well as the function sets that are defined within the 
secured logon application data store". Thus, the depicted interface allows an administrator to 
make changes to the underlying object class definitions. 

As per Applicant's argument that Keinsley et al. do not teach redefining the tailored 
object class definition to include the first field and the second field in claim 1, the Examiner 
respectfully disagrees. The Examiner cited Fig. 15, which shows an interface to temporarily 
suspend a user. An administrator redefines the tailored object class definition by changing a 
user's status. This is accomplished at the object class level as shown in paragraph This is 
defined in [0701], "A VB6 COM DLL exposes a single class (b_System Application) containing 
methods to allow business functions to access data associated with the sponsor organization's 
secured logon application. Data stored and exposed includes Entity and User security 
information, as well as the function sets that are defined within the secured logon application 
data store". 

As per Applicant's argument that Keinsley et al. do not disclose changing a status of a 
field in a first instance of a tailored object in claim 17, the Examiner respectfully disagrees. The 
Examiner cited Fig. 15, which shows an interface to temporarily suspend a user. An 
administrator is able to change the status of a user's access rights via the interface of Fig. 15. 
This change is carried out in at an object class level, as indicated by [0701], "A VB6 COM DLL 
exposes a single class (b_SystemApplication) containing methods to allow business functions to 
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access data associated with the sponsor organization's secured logon application. Data stored and 
exposed includes Entity and User security information, as well as the function sets that are 
defined within the secured logon application data store". Thus, Keinsley et al. do disclose 
changing a status of a field in a first instance of a tailored object. 

As per Applicant's argument that Keinsley et al. do not disclose a data structure 
definition, the Examiner respectfully disagrees. The Examiner cited Fig. 15, which shows an 
interface to temporarily suspend a user. This interface clearly contains a data structure definition 
identifier (See e.g. Fig. 15A which shows a data structure, i.e. the list of users, and is identified 
as "User Selection"), a collection of one or more hardcoded elements hardcoded into the data 
structure definition (See e.g. Fig. 15A where the table columns are "hardcoded" and the 
individual table cells are not), and a collection of one or more tailored elements to fit a specific 
data processing activity of a user (See e.g. Fig. 15B where, when the "Status" is "Inactive", the 
user is temporarily suspended, see e.g. [0570], "An access administrator for an entity or the IT 
security personnel of the sponsor organization can temporarily suspend a user for the entity"). 
These features are implemented at the object class level, as indicated by [0701], "A VB6 COM 
DLL exposes a single class (b__SystemApplication) containing methods to allow business 
functions to access data associated with the sponsor organization's secured logon application. 
Data stored and exposed includes Entity and User security information, as well as the function 
sets that are defined within the secured logon application data store". 
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Conclusion 

THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time 
policy as set forth in 37 CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within TWO 
MONTHS of the mailing date of this final action and the advisory action is not mailed until after 
the end of the THREE-MONTH shortened statutory period, then the shortened statutory period 
will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 
CFR 1 .136(a) will be calculated from the mailing date of the advisory action. In no event, 
however, will the statutory period for reply expire later than SIX MONTHS from the mailing 
date of this final action. 

Any inquiry concerning this communication or earlier communications from the 
Examiner should be directed to Aaron J. Sanders whose telephone number is 571-270-1016. The 
Examiner can normally be reached on M-Th 8:00a-5:00p. 

If attempts to reach the Examiner by telephone are unsuccessful, the Examiner's 
supervisor, Tim Vo can be reached on 571-272-3642. The fax phone number for the 
organization where this application or proceeding is assigned is 571-273-8300. 



Application/Control Number: 10/674,327 



Page 19 



Art Unit: 2168 

Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would 
like assistance from a USPTO Customer Service Representative or access to the automated 
information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 



/AJS/ 

Aaron J. Sanders 
Examiner 
12 July 2007 
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